NestPass

end-to-end encrypted · read once · self-destructs

NestPass lets you share a secret — a password, a file, a note — that self-destructs after someone reads it. Encrypted in your browser before it ever reaches the server.

1 Type your secret and click encrypt & generate link
2 Share the link (the key is in the # — your browser never sends it)
3 The recipient opens it once and it's gone forever

1. Encrypt in your browser. Your browser generates a random AES-256 key and encrypts your text or file before anything is sent to the server.

2. Store on the server. The server only sees encrypted garbage — it cannot read your message.

3. Share the link. The decryption key is embedded in the URL's # fragment. Browsers never send the fragment to the server, so the key stays between you and the recipient.

4. One-time reveal. The recipient's browser decrypts the secret locally. The server deletes the ciphertext immediately after.

  • AES-256-GCM — military-grade symmetric encryption
  • Client-side encryption — plaintext never touches the server
  • Zero-knowledge server — the server only stores ciphertext
  • Self-destructing — data is deleted after reveal or expiry
  • Configurable TTL — secrets expire after 1 hour to 1 week
  • Limited reveals — choose how many times a whistle can be opened
  • Password protection — optional extra layer via PBKDF2 key derivation
  • No tracking — no cookies, no analytics, no logs of your content
  • Open source — audit the code yourself

Files are encrypted with the same AES-256-GCM algorithm used for text. The entire file is encrypted in your browser before upload, and decrypted in the recipient's browser after download. The server never has access to the unencrypted file.

Supported file size: up to 7.75 GB. All file data is stored encrypted on disk and permanently deleted after the whistle self-destructs.

When you set a password, the encryption key is derived from your password using PBKDF2 (100,000 iterations, SHA-256) instead of being embedded in the URL.

This means the recipient needs both the link and the password to decrypt. Share them through separate channels for maximum security.